Mittwald says its MCP server let an attacker into 56 hosting projects

Mittwald, a German hosting provider for web agencies, says an attacker got into 56 customer projects through its MCP server, the interface customers used to connect AI assistants to mStudio, Mittwald’s hosting control panel. Managing director Robert Meyer set out the timeline in a post on 7 November.

What happened

According to Mittwald:

• 21 October: the attacker first tested a vulnerability in the MCP server.
• 23 to 27 October: they used the platform as a normal user, registering test accounts, trying extensions and making simple injection attempts.
• 27 October, 15:03: five minutes after registering another account, they exploited the MCP flaw.
• 4 November: Mittwald spotted unusual behaviour, locked the attacker’s first account at 11:11, identified the MCP server as the entry point and shut it down.
• 5 to 7 November: projects with traces of the attacker were locked, new sign-ups paused, mStudio login and SSH disabled, then restored on 7 November with passkey support added. Sites Mittwald locked as a precaution stay locked for now.

Mittwald’s template letter for agencies explains the mechanism: the attacker read the access tokens of customers who used the MCP interface, and each token had the same rights in mStudio as the customer. That puts site files, code, databases, stored third-party credentials and mailboxes in scope. Mittwald says passwords were not read, and that after forensic review of the 56 projects and repeated scans it found no further compromised projects. Sites managed in its separate Kundencenter were not affected.

Mittwald has not said what the flaw was. The Record notes it is unclear whether it sat in Mittwald’s own code or in open-source MCP libraries. Mittwald promises a detailed report this week.

The AI angle, with care

Meyer writes that the attacker moved through the system so fast, sometimes seconds between steps, that it points to AI tools. That is Mittwald’s inference from its logs. The Record reports Mittwald gave no other evidence, and scripts are fast too.

Why this matters

An MCP server that holds a user’s full-rights token turns one bug into access to everything that user can touch, which is what Mittwald describes. If you ship an MCP server for your platform, give it narrowly scoped, short-lived tokens bound to that server, as our explainer on why a token for one MCP server belongs to that server lays out. As a customer, revoke tokens you issued to AI connectors you no longer use. For another recent server-side MCP bug, see AWS’s Serverless MCP Server path traversal; our MCP explainer covers how these servers sit between agents and your systems.